From 185252fca310c4bfa19d3b8feb1879dc59c54878 Mon Sep 17 00:00:00 2001
From: Zuoyuan Huang <zuoyuan@amazon.com>
Date: Thu, 8 Aug 2024 16:27:59 +0000
Subject: [PATCH 1/6] Update CSP for CodeEditor

---
 .../src/vs/server/node/webClientServer.ts           |  2 +-
 patches/series                                      |  1 +
 patches/update-csp.diff                             | 13 +++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 patches/update-csp.diff

diff --git a/patched-vscode/src/vs/server/node/webClientServer.ts b/patched-vscode/src/vs/server/node/webClientServer.ts
index 670d3bf0..da8d1165 100644
--- a/patched-vscode/src/vs/server/node/webClientServer.ts
+++ b/patched-vscode/src/vs/server/node/webClientServer.ts
@@ -390,7 +390,7 @@ export class WebClientServer {
 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
 			'worker-src \'self\' data: blob:;',
 			'style-src \'self\' \'unsafe-inline\';',
-			'connect-src \'self\' ws: wss: https:;',
+			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://*.blob.core.windows.net https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
 			'font-src \'self\' blob:;',
 			'manifest-src \'self\';'
 		].join(' ');
diff --git a/patches/series b/patches/series
index 22aa2c9f..000b8375 100644
--- a/patches/series
+++ b/patches/series
@@ -1,6 +1,7 @@
 sagemaker-extension.diff
 disable-online-services.diff
 disable-telemetry.diff
+update-csp.diff
 base-path.diff
 webview.diff
 local-storage.diff
diff --git a/patches/update-csp.diff b/patches/update-csp.diff
new file mode 100644
index 00000000..0b23280c
--- /dev/null
+++ b/patches/update-csp.diff
@@ -0,0 +1,13 @@
+Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
+===================================================================
+--- sagemaker-code-editor.orig/vscode/src/vs/server/node/webClientServer.ts
++++ sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
+@@ -375,7 +375,7 @@ export class WebClientServer {
+ 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
+ 			'worker-src \'self\' data: blob:;',
+ 			'style-src \'self\' \'unsafe-inline\';',
+-			'connect-src \'self\' ws: wss: https:;',
++			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://*.blob.core.windows.net https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
+ 			'font-src \'self\' blob:;',
+ 			'manifest-src \'self\';'
+ 		].join(' ');

From 320497837ae6e367e059830cc57e0e80dcc6303c Mon Sep 17 00:00:00 2001
From: Zuoyuan Huang <zuoyuan@amazon.com>
Date: Wed, 2 Oct 2024 16:38:59 +0000
Subject: [PATCH 2/6] Further restrict CSP for CodeEditor

---
 patches/update-csp.diff | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patches/update-csp.diff b/patches/update-csp.diff
index 0b23280c..5f49876b 100644
--- a/patches/update-csp.diff
+++ b/patches/update-csp.diff
@@ -7,7 +7,7 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
  			'worker-src \'self\' data: blob:;',
  			'style-src \'self\' \'unsafe-inline\';',
 -			'connect-src \'self\' ws: wss: https:;',
-+			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://*.blob.core.windows.net https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
++			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
  			'font-src \'self\' blob:;',
  			'manifest-src \'self\';'
  		].join(' ');

From c1eed2ed3f5b075a4c67f0a732307861eaf6419b Mon Sep 17 00:00:00 2001
From: Alvin Solidum <asolidu@amazon.com>
Date: Tue, 15 Oct 2024 00:32:07 -0700
Subject: [PATCH 3/6] Move .sagemaker-last-active-timestamp to /tmp/

---
 .../sagemaker-idle-extension/src/extension.ts | 11 ++++------
 .../src/vs/server/node/webClientServer.ts     |  8 ++-----
 patches/sagemaker-idle-extension.patch        | 22 ++++++-------------
 3 files changed, 13 insertions(+), 28 deletions(-)

diff --git a/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts b/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
index 0fbb35e6..b6c1f46a 100644
--- a/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
+++ b/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
@@ -21,20 +21,17 @@ export function deactivate() {
 
 /**
  * Initializes the file path where the idle timestamp will be stored.
- * It sets the path to a hidden file in the user's home directory.
+ * It sets the path to a hidden file in the /tmp/ directory.
  */
 function initializeIdleFilePath() {
-	const homeDirectory = process.env.HOME || process.env.USERPROFILE;
-	if (!homeDirectory) {
-		console.log(`${LOG_PREFIX} Unable to determine the home directory.`);
-		return;
-	}
-	idleFilePath = path.join(homeDirectory, ".sagemaker-last-active-timestamp");
+	const tmpDirectory = "/tmp/"; 
+	idleFilePath = path.join(tmpDirectory, ".sagemaker-last-active-timestamp");
 
 	// Set initial lastActivetimestamp
 	updateLastActivityTimestamp()
 }
 
+
 /**
  * Registers event listeners to monitor user activity within the VSCode editor.
  * It listens to document changes, editor focus changes, text selection changes, and terminal events.
diff --git a/patched-vscode/src/vs/server/node/webClientServer.ts b/patched-vscode/src/vs/server/node/webClientServer.ts
index da8d1165..d75ad762 100644
--- a/patched-vscode/src/vs/server/node/webClientServer.ts
+++ b/patched-vscode/src/vs/server/node/webClientServer.ts
@@ -463,12 +463,8 @@ export class WebClientServer {
    */
 	private async _handleIdle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
 		try {
-			const homeDirectory = process.env.HOME || process.env.USERPROFILE;
-			if (!homeDirectory) {
-				throw new Error('Home directory not found');
-			}
-
-			const idleFilePath = path.join(homeDirectory, '.code-editor-last-active-timestamp');
+			const tmpDirectory = '/tmp/'
+			const idleFilePath = path.join(tmpDirectory, '.sagemaker-last-active-timestamp');
 			const data = await readFile(idleFilePath, 'utf8');
 
 			res.statusCode = 200;
diff --git a/patches/sagemaker-idle-extension.patch b/patches/sagemaker-idle-extension.patch
index f42b600d..32c2d6e4 100644
--- a/patches/sagemaker-idle-extension.patch
+++ b/patches/sagemaker-idle-extension.patch
@@ -147,7 +147,7 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-idle-extension/src/exte
 ===================================================================
 --- /dev/null
 +++ sagemaker-code-editor/vscode/extensions/sagemaker-idle-extension/src/extension.ts
-@@ -0,0 +1,116 @@
+@@ -0,0 +1,112 @@
 +import * as vscode from "vscode";
 +import * as fs from "fs";
 +import * as path from "path";
@@ -171,15 +171,11 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-idle-extension/src/exte
 +
 +/**
 + * Initializes the file path where the idle timestamp will be stored.
-+ * It sets the path to a hidden file in the user's home directory.
++ * It sets the path to a hidden file in the /tmp/ directory.
 + */
 +function initializeIdleFilePath() {
-+	const homeDirectory = process.env.HOME || process.env.USERPROFILE;
-+	if (!homeDirectory) {
-+		console.log(`${LOG_PREFIX} Unable to determine the home directory.`);
-+		return;
-+	}
-+	idleFilePath = path.join(homeDirectory, ".sagemaker-last-active-timestamp");
++	const tmpDirectory = "/tmp/"; 
++	idleFilePath = path.join(tmpDirectory, ".sagemaker-last-active-timestamp");
 +
 +	// Set initial lastActivetimestamp
 +	updateLastActivityTimestamp()
@@ -327,7 +323,7 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
  			if (pathname === this._callbackRoute) {
  				// callback support
  				return this._handleCallback(res);
-@@ -451,6 +457,27 @@ export class WebClientServer {
+@@ -451,6 +457,23 @@ export class WebClientServer {
  		});
  		return void res.end(data);
  	}
@@ -337,12 +333,8 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
 +   */
 +	private async _handleIdle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
 +		try {
-+			const homeDirectory = process.env.HOME || process.env.USERPROFILE;
-+			if (!homeDirectory) {
-+				throw new Error('Home directory not found');
-+			}
-+
-+			const idleFilePath = path.join(homeDirectory, '.sagemaker-last-active-timestamp');
++			const tmpDirectory = '/tmp/'
++			const idleFilePath = path.join(tmpDirectory, '.sagemaker-last-active-timestamp');
 +			const data = await readFile(idleFilePath, 'utf8');
 +
 +			res.statusCode = 200;

From ecfe4e12d29ce2b7da57d9ee194edf06f8c3be9c Mon Sep 17 00:00:00 2001
From: Zuoyuan Huang <zuoyuan@amazon.com>
Date: Fri, 18 Oct 2024 05:56:19 +0000
Subject: [PATCH 4/6] Add warning message on auto update being turned off

---
 .../sagemaker-extension/package.json          | 10 ++-
 .../sagemaker-extension/src/extension.ts      | 35 ++++++++++
 patches/sagemaker-extension.diff              | 49 ++++++++++++--
 scripts/install.sh                            | 65 ++++++++++---------
 scripts/postinstall.sh                        | 16 ++++-
 5 files changed, 138 insertions(+), 37 deletions(-)

diff --git a/patched-vscode/extensions/sagemaker-extension/package.json b/patched-vscode/extensions/sagemaker-extension/package.json
index 88e8cc0e..0614b6b9 100644
--- a/patched-vscode/extensions/sagemaker-extension/package.json
+++ b/patched-vscode/extensions/sagemaker-extension/package.json
@@ -27,8 +27,14 @@
   "contributes": {
     "configuration": {
       "type": "object",
-      "title": "Sagemaker Extension",
-      "properties": {}
+      "title": "SageMaker Extension",
+      "properties": {
+        "sagemaker-extension.notification.extensionAutoUpdateDisabled": {
+          "type": "boolean",
+          "default": true,
+          "markdownDescription": "Show notification if extension auto update is disabled"
+        }
+      }
     },
     "commands": [
     ]
diff --git a/patched-vscode/extensions/sagemaker-extension/src/extension.ts b/patched-vscode/extensions/sagemaker-extension/src/extension.ts
index b85cec6a..a64f8e9c 100644
--- a/patched-vscode/extensions/sagemaker-extension/src/extension.ts
+++ b/patched-vscode/extensions/sagemaker-extension/src/extension.ts
@@ -17,6 +17,7 @@ import * as console from "console";
 
 
 const PARSE_SAGEMAKER_COOKIE_COMMAND = 'sagemaker.parseCookies';
+const ENABLE_AUTO_UPDATE_COMMAND = 'workbench.extensions.action.enableAutoUpdate';
 
 function showWarningDialog() {
     vscode.commands.executeCommand(PARSE_SAGEMAKER_COOKIE_COMMAND).then(response => {
@@ -121,6 +122,37 @@ function updateStatusItemWithMetadata(context: vscode.ExtensionContext) {
     });
 }
 
+// Render warning message regarding auto upgrade disabled
+function renderExtensionAutoUpgradeDisabledNotification() {
+    // Get current extension auto disabled config
+    const autoUpdateEnabled = vscode.workspace.getConfiguration('extensions').get('autoUpdate');
+
+    // Check if customer has choose to disable this notification
+    const extensionConfig = vscode.workspace.getConfiguration('sagemaker-extension');
+    const showNotificationEnabled = extensionConfig.get('notification.extensionAutoUpdateDisabled', true);
+
+    // Only show notification, if auto update is disabled, and customer hasn't opt-out the notification
+    if (showNotificationEnabled && autoUpdateEnabled == false) {
+        const enableAutoUpdate = 'Enable Auto Update Extensions';
+        const doNotShowAgain = 'Do not show again';
+        vscode.window.showInformationMessage(
+            'Extension auto-update is disabled. This can be changed in Code Editor settings.',
+            enableAutoUpdate,
+            doNotShowAgain,
+        ).then(response => {
+            if (response === enableAutoUpdate) {
+                vscode.commands.executeCommand(ENABLE_AUTO_UPDATE_COMMAND)
+            } else if (response == doNotShowAgain) {
+                extensionConfig.update(
+                    'notification.extensionAutoUpdateDisabled',
+                    false,
+                    vscode.ConfigurationTarget.Global
+                );
+            }
+        })
+    }
+}
+
 export function activate(context: vscode.ExtensionContext) {
 
     // TODO: log activation of extension
@@ -134,4 +166,7 @@ export function activate(context: vscode.ExtensionContext) {
         initialize(sagemakerCookie);
         updateStatusItemWithMetadata(context);
     });
+
+    // render warning message regarding auto upgrade disabled
+    renderExtensionAutoUpgradeDisabledNotification();
 }
diff --git a/patches/sagemaker-extension.diff b/patches/sagemaker-extension.diff
index 998215f2..0fbc636a 100644
--- a/patches/sagemaker-extension.diff
+++ b/patches/sagemaker-extension.diff
@@ -2,7 +2,7 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/extension
 ===================================================================
 --- /dev/null
 +++ sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/extension.ts
-@@ -0,0 +1,137 @@
+@@ -0,0 +1,172 @@
 +import * as vscode from 'vscode';
 +import * as fs from 'fs';
 +import { SessionWarning } from "./sessionWarning";
@@ -22,6 +22,7 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/extension
 +
 +
 +const PARSE_SAGEMAKER_COOKIE_COMMAND = 'sagemaker.parseCookies';
++const ENABLE_AUTO_UPDATE_COMMAND = 'workbench.extensions.action.enableAutoUpdate';
 +
 +function showWarningDialog() {
 +    vscode.commands.executeCommand(PARSE_SAGEMAKER_COOKIE_COMMAND).then(response => {
@@ -126,6 +127,37 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/extension
 +    });
 +}
 +
++// Render warning message regarding auto upgrade disabled
++function renderExtensionAutoUpgradeDisabledNotification() {
++    // Get current extension auto disabled config
++    const autoUpdateEnabled = vscode.workspace.getConfiguration('extensions').get('autoUpdate');
++
++    // Check if customer has choose to disable this notification
++    const extensionConfig = vscode.workspace.getConfiguration('sagemaker-extension');
++    const showNotificationEnabled = extensionConfig.get('notification.extensionAutoUpdateDisabled', true);
++
++    // Only show notification, if auto update is disabled, and customer hasn't opt-out the notification
++    if (showNotificationEnabled && autoUpdateEnabled == false) {
++        const enableAutoUpdate = 'Enable Auto Update Extensions';
++        const doNotShowAgain = 'Do not show again';
++        vscode.window.showInformationMessage(
++            'Extension auto-update is disabled. This can be changed in Code Editor settings.',
++            enableAutoUpdate,
++            doNotShowAgain,
++        ).then(response => {
++            if (response === enableAutoUpdate) {
++                vscode.commands.executeCommand(ENABLE_AUTO_UPDATE_COMMAND)
++            } else if (response == doNotShowAgain) {
++                extensionConfig.update(
++                    'notification.extensionAutoUpdateDisabled',
++                    false,
++                    vscode.ConfigurationTarget.Global
++                );
++            }
++        })
++    }
++}
++
 +export function activate(context: vscode.ExtensionContext) {
 +
 +    // TODO: log activation of extension
@@ -139,6 +171,9 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/extension
 +        initialize(sagemakerCookie);
 +        updateStatusItemWithMetadata(context);
 +    });
++
++    // render warning message regarding auto upgrade disabled
++    renderExtensionAutoUpgradeDisabledNotification();
 +}
 Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/src/sessionWarning.ts
 ===================================================================
@@ -211,7 +246,7 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/package.json
 ===================================================================
 --- /dev/null
 +++ sagemaker-code-editor/vscode/extensions/sagemaker-extension/package.json
-@@ -0,0 +1,46 @@
+@@ -0,0 +1,52 @@
 +{
 +  "name": "sagemaker-extension",
 +  "displayName": "Sagemaker Extension",
@@ -241,8 +276,14 @@ Index: sagemaker-code-editor/vscode/extensions/sagemaker-extension/package.json
 +  "contributes": {
 +    "configuration": {
 +      "type": "object",
-+      "title": "Sagemaker Extension",
-+      "properties": {}
++      "title": "SageMaker Extension",
++      "properties": {
++        "sagemaker-extension.notification.extensionAutoUpdateDisabled": {
++          "type": "boolean",
++          "default": true,
++          "markdownDescription": "Show notification if extension auto update is disabled"
++        }
++      }
 +    },
 +    "commands": [
 +    ]
diff --git a/scripts/install.sh b/scripts/install.sh
index cc7a78af..4487cadc 100644
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -1,26 +1,27 @@
 #!/bin/bash
 
-while getopts "v:" opt; do
-  case $opt in
-    v) version="$OPTARG"
-    ;;
-    \?) echo "Invalid option -$OPTARG" >&2
-    exit 1
-    ;;
-  esac
+usage() {
+  printf """
+Usage: $0 [-t <VERSION>] [-v] [-h]
+
+Otions:
+  -t <VERSION>    Create a tarball with the specified version
+  -v              Enable verbose output
+  -h              Show this help message
+"""
+}
 
-  case $OPTARG in
-    -*) echo "Option $opt needs a valid argument"
-    exit 1
-    ;;
+while getopts "t:hv" opt; do
+  case $opt in
+    t)  version="$OPTARG"
+        CREATE_TARBALL=true ;;
+    v)  VERBOSE_ARG="--verbose" ;;
+    h)  usage; exit 0 ;;
+    :)  printf "Error: -${OPTARG} requires an argument.\n" >&2; exit 1 ;;
+    ?) usage; exit 1 ;;
   esac
 done
 
-if [[ -z $version ]]; then
- echo "Please provide version using '-v'";
- exit 1
-fi
-
 VERSION=$version
 
 # set +e to prevent quilt from exiting when no patches popped
@@ -48,11 +49,11 @@ git submodule update --init
 # Apply patches
 printf "\n======== Applying patches ========\n"
 {
-    quilt push -a --leave-rejects --color=auto 
+  quilt push -a --leave-rejects --color=auto 
 } || {
-        printf "\nPatching error, review logs!\n"
-        find ./vscode -name "*.rej"
-        exit 1
+  printf "\nPatching error, review logs!\n"
+  find ./vscode -name "*.rej"
+  exit 1
 }
 
 
@@ -68,19 +69,25 @@ cd ${PROJ_ROOT}
 printf "\n======== Comment out breaking git config lines in postinstall.js ========\n"
 sh ${PROJ_ROOT}/scripts/postinstall.sh
 
-# Build tarball for conda feedstock from vscode dir
-printf "\n======== Build Tarball for Conda Feedstock ========\n"
-bash ${PROJ_ROOT}/scripts/create_code_editor_tarball.sh -v ${VERSION}
+# Delete node_modules to prevent node-gyp build error and reduce tarball size
+printf "\n======== Deleting vscode/node_modules ========\n"
+find "${PROJ_ROOT}/vscode" -name "node_modules" -type d -prune -exec rm -rf '{}' +
+
+# Create tarball
+if [ "$CREATE_TARBALL" = true ]; then
+  # Build tarball for conda feedstock from vscode dir
+  printf "\n======== Build Tarball for Conda Feedstock ========\n"
+  bash ${PROJ_ROOT}/scripts/create_code_editor_tarball.sh -v ${VERSION}
+fi
 
 # Copy resources
 printf "\n======== Copy resources ========\n"
-sh ${PROJ_ROOT}/scripts/copy-resources.sh
+${PROJ_ROOT}/scripts/copy-resources.sh
 
-# Delete node_modules to prevent node-gyp build error
-printf "\n======== Deleting vscode/node_modules ========\n"
-rm -rf "${PROJ_ROOT}/vscode/node_modules"
+# Copy patched files to patches-vscode
+cp -R vscode/* patched-vscode/
 
 # Build the project
 printf "\n======== Building project in ${PROJ_ROOT}/vscode ========\n"
-yarn --cwd "${PROJ_ROOT}/vscode" install --pure-lockfile --verbose
+yarn --cwd "${PROJ_ROOT}/vscode" install --pure-lockfile ${VERBOSE_ARG}
 yarn --cwd "${PROJ_ROOT}/vscode" download-builtin-extensions
diff --git a/scripts/postinstall.sh b/scripts/postinstall.sh
index 6ec20d75..cbeb5f9f 100644
--- a/scripts/postinstall.sh
+++ b/scripts/postinstall.sh
@@ -15,7 +15,19 @@ if [ ! -f "$POSTINSTALL_JS_PATH" ]; then
     exit 1
 fi
 
-# Use sed to comment out the specific lines
-sed -i '' '/cp\.execSync('"'"'git config .*);/s/^/\/\/ /' "$POSTINSTALL_JS_PATH"
+# set +e to prevent script from exiting when not on macOS
+set +e
+
+# Check if on macOS
+system_profiler SPSoftwareDataType
+
+# Run with different arguments depending on the OS
+if [ $? -eq 0 ]; then
+    # Use sed to comment out the specific lines
+    sed -i '' '/cp\.execSync('"'"'git config .*);/s/^/\/\/ /' "$POSTINSTALL_JS_PATH"
+else
+    # Use sed to comment out the specific lines
+    sed -i '/cp\.execSync('"'"'git config .*);/s/^/\/\/ /' "$POSTINSTALL_JS_PATH"
+fi
 
 echo "Specified git config lines have been commented out in $POSTINSTALL_JS_PATH."

From aa953d9de37f7c477e97e04fcdc869f6f3866a43 Mon Sep 17 00:00:00 2001
From: Zuoyuan Huang <zuoyuan@amazon.com>
Date: Mon, 4 Nov 2024 07:18:06 +0000
Subject: [PATCH 5/6] Patch braces and micromatch

---
 patched-vscode/build/yarn.lock                |  16 +-
 patched-vscode/extensions/npm/yarn.lock       |  36 +--
 .../sagemaker-idle-extension/src/extension.ts |  15 +-
 patched-vscode/extensions/yarn.lock           |  26 +-
 patched-vscode/remote/yarn.lock               |  26 +-
 .../src/vs/server/node/webClientServer.ts     |   2 +-
 patched-vscode/yarn.lock                      |  44 +--
 patches/security.diff                         | 287 ++++++++++++++++++
 patches/series                                |   3 +-
 9 files changed, 371 insertions(+), 84 deletions(-)
 create mode 100644 patches/security.diff

diff --git a/patched-vscode/build/yarn.lock b/patched-vscode/build/yarn.lock
index 3131c432..ab5b312b 100644
--- a/patched-vscode/build/yarn.lock
+++ b/patched-vscode/build/yarn.lock
@@ -879,11 +879,11 @@ brace-expansion@^1.1.7:
     concat-map "0.0.1"
 
 braces@~3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
+  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
   dependencies:
-    fill-range "^7.0.1"
+    fill-range "^7.1.1"
 
 buffer-alloc-unsafe@^1.1.0:
   version "1.1.0"
@@ -1422,10 +1422,10 @@ fd-slicer@~1.1.0:
   dependencies:
     pend "~1.2.0"
 
-fill-range@^7.0.1:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
+fill-range@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
+  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
   dependencies:
     to-regex-range "^5.0.1"
 
diff --git a/patched-vscode/extensions/npm/yarn.lock b/patched-vscode/extensions/npm/yarn.lock
index a7afc9f8..d1f79c9f 100644
--- a/patched-vscode/extensions/npm/yarn.lock
+++ b/patched-vscode/extensions/npm/yarn.lock
@@ -38,22 +38,22 @@ brace-expansion@^2.0.1:
   dependencies:
     balanced-match "^1.0.0"
 
-braces@^3.0.1:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
+braces@^3.0.3:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
+  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
   dependencies:
-    fill-range "^7.0.1"
+    fill-range "^7.1.1"
 
 esprima@^4.0.0:
   version "4.0.1"
   resolved "https://registry.yarnpkg.com/esprima/-/esprima-4.0.1.tgz#13b04cdb3e6c5d19df91ab6987a8695619b0aa71"
   integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
 
-fill-range@^7.0.1:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
+fill-range@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
+  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
   dependencies:
     to-regex-range "^5.0.1"
 
@@ -118,12 +118,12 @@ locate-path@^6.0.0:
     p-locate "^5.0.0"
 
 micromatch@^4.0.2:
-  version "4.0.2"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.2.tgz#4fcb0999bf9fbc2fcbdd212f6d629b9a56c39259"
-  integrity sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.1"
-    picomatch "^2.0.5"
+    braces "^3.0.3"
+    picomatch "^2.3.1"
 
 minimatch@^5.1.6:
   version "5.1.6"
@@ -151,10 +151,10 @@ path-exists@^4.0.0:
   resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-4.0.0.tgz#513bdbe2d3b95d7762e8c1137efa195c6c61b5b3"
   integrity sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==
 
-picomatch@^2.0.5:
-  version "2.2.2"
-  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.2.2.tgz#21f333e9b6b8eaff02468f5146ea406d345f4dad"
-  integrity sha512-q0M/9eZHzmr0AulXyPwNfZjtwZ/RBZlbN3K3CErVrk50T2ASYI7Bye0EvekFY3IP1Nt2DHu0re+V2ZHIpMkuWg==
+picomatch@^2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.1.tgz#3ba3833733646d9d3e4995946c1365a67fb07a42"
+  integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==
 
 pify@^4.0.1:
   version "4.0.1"
diff --git a/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts b/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
index b6c1f46a..2a11ca44 100644
--- a/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
+++ b/patched-vscode/extensions/sagemaker-idle-extension/src/extension.ts
@@ -31,7 +31,6 @@ function initializeIdleFilePath() {
 	updateLastActivityTimestamp()
 }
 
-
 /**
  * Registers event listeners to monitor user activity within the VSCode editor.
  * It listens to document changes, editor focus changes, text selection changes, and terminal events.
@@ -67,13 +66,13 @@ const startMonitoringTerminalActivity = () => {
 
 /**
  * Checks for terminal activity by reading the /dev/pts directory and comparing modification times of the files.
- * 
+ *
  * The /dev/pts directory is used in Unix-like operating systems to represent pseudo-terminal (PTY) devices.
- * Each active terminal session is assigned a PTY device. These devices are represented as files within the /dev/pts directory. 
- * When a terminal session has activity, such as when a user inputs commands or output is written to the terminal, 
- * the modification time (mtime) of the corresponding PTY device file is updated. By monitoring the modification 
+ * Each active terminal session is assigned a PTY device. These devices are represented as files within the /dev/pts directory.
+ * When a terminal session has activity, such as when a user inputs commands or output is written to the terminal,
+ * the modification time (mtime) of the corresponding PTY device file is updated. By monitoring the modification
  * times of the files in the /dev/pts directory, we can detect terminal activity.
- * 
+ *
  * If activity is detected (i.e., if any PTY device file was modified within the CHECK_INTERVAL), this function
  * updates the last activity timestamp.
  */
@@ -92,7 +91,7 @@ const checkTerminalActivity = () => {
 				const mtime = new Date(stats.mtime).getTime();
 				return now - mtime < CHECK_INTERVAL;
 			} catch (error) {
-				console.error(`${LOG_PREFIX}}Error reading file stats:`, error);
+				console.error(`${LOG_PREFIX} Error reading file stats:`, error);
 				return false;
 			}
 		});
@@ -103,7 +102,7 @@ const checkTerminalActivity = () => {
 	});
 };
 
- /**
+/**
  * Updates the last activity timestamp by recording the current timestamp in the idle file and
  * refreshing the status bar. The timestamp should be in ISO 8601 format and set to the UTC timezone.
  */
diff --git a/patched-vscode/extensions/yarn.lock b/patched-vscode/extensions/yarn.lock
index fa4595ff..5be9ecc9 100644
--- a/patched-vscode/extensions/yarn.lock
+++ b/patched-vscode/extensions/yarn.lock
@@ -127,12 +127,12 @@
     node-addon-api "^3.2.1"
     node-gyp-build "^4.3.0"
 
-braces@^3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
+braces@^3.0.3:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
+  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
   dependencies:
-    fill-range "^7.0.1"
+    fill-range "^7.1.1"
 
 coffeescript@1.12.7:
   version "1.12.7"
@@ -180,10 +180,10 @@ fast-plist@0.1.2:
   resolved "https://registry.yarnpkg.com/fast-plist/-/fast-plist-0.1.2.tgz#a45aff345196006d406ca6cdcd05f69051ef35b8"
   integrity sha1-pFr/NFGWAG1AbKbNzQX2kFHvNbg=
 
-fill-range@^7.0.1:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
+fill-range@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
+  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
   dependencies:
     to-regex-range "^5.0.1"
 
@@ -205,11 +205,11 @@ is-number@^7.0.0:
   integrity sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==
 
 micromatch@^4.0.5:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.2"
+    braces "^3.0.3"
     picomatch "^2.3.1"
 
 node-addon-api@^3.2.1:
diff --git a/patched-vscode/remote/yarn.lock b/patched-vscode/remote/yarn.lock
index 4241bf03..9cbe1d8f 100644
--- a/patched-vscode/remote/yarn.lock
+++ b/patched-vscode/remote/yarn.lock
@@ -185,12 +185,12 @@ bl@^4.0.3:
     inherits "^2.0.4"
     readable-stream "^3.4.0"
 
-braces@^3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
+braces@^3.0.3:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
+  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
   dependencies:
-    fill-range "^7.0.1"
+    fill-range "^7.1.1"
 
 buffer-crc32@~0.2.3:
   version "0.2.13"
@@ -263,10 +263,10 @@ file-uri-to-path@1.0.0:
   resolved "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz#553a7b8446ff6f684359c445f1e37a05dacc33dd"
   integrity sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==
 
-fill-range@^7.0.1:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
+fill-range@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
+  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
   dependencies:
     to-regex-range "^5.0.1"
 
@@ -378,11 +378,11 @@ lru-cache@^6.0.0:
     yallist "^4.0.0"
 
 micromatch@^4.0.5:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.2"
+    braces "^3.0.3"
     picomatch "^2.3.1"
 
 mimic-response@^3.1.0:
diff --git a/patched-vscode/src/vs/server/node/webClientServer.ts b/patched-vscode/src/vs/server/node/webClientServer.ts
index d75ad762..15957445 100644
--- a/patched-vscode/src/vs/server/node/webClientServer.ts
+++ b/patched-vscode/src/vs/server/node/webClientServer.ts
@@ -390,7 +390,7 @@ export class WebClientServer {
 			`frame-src 'self' https://*.vscode-cdn.net data:;`,
 			'worker-src \'self\' data: blob:;',
 			'style-src \'self\' \'unsafe-inline\';',
-			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://*.blob.core.windows.net https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
+			'connect-src \'self\' ws: wss: https://main.vscode-cdn.net http://localhost:* https://localhost:* https://login.microsoftonline.com/ https://update.code.visualstudio.com https://*.vscode-unpkg.net/ https://default.exp-tas.com/vscode/ab https://vscode-sync.trafficmanager.net https://vscode-sync-insiders.trafficmanager.net https://*.gallerycdn.vsassets.io https://marketplace.visualstudio.com https://az764295.vo.msecnd.net  https://code.visualstudio.com https://*.gallery.vsassets.io https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://*.servicebus.windows.net/ https://vscode.blob.core.windows.net https://vscode.search.windows.net https://vsmarketplacebadges.dev https://vscode.download.prss.microsoft.com https://download.visualstudio.microsoft.com https://*.vscode-unpkg.net https://open-vsx.org;',
 			'font-src \'self\' blob:;',
 			'manifest-src \'self\';'
 		].join(' ');
diff --git a/patched-vscode/yarn.lock b/patched-vscode/yarn.lock
index f2613cee..04ea9592 100644
--- a/patched-vscode/yarn.lock
+++ b/patched-vscode/yarn.lock
@@ -2618,11 +2618,11 @@ braces@^2.3.1, braces@^2.3.2:
     to-regex "^3.0.1"
 
 braces@^3.0.1, braces@^3.0.2, braces@~3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
+  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
   dependencies:
-    fill-range "^7.0.1"
+    fill-range "^7.1.1"
 
 browser-stdout@1.3.1:
   version "1.3.1"
@@ -4569,10 +4569,10 @@ fill-range@^4.0.0:
     repeat-string "^1.6.1"
     to-regex-range "^2.1.0"
 
-fill-range@^7.0.1:
-  version "7.0.1"
-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
+fill-range@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
+  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
   dependencies:
     to-regex-range "^5.0.1"
 
@@ -6874,27 +6874,27 @@ micromatch@^3.0.4, micromatch@^3.1.10, micromatch@^3.1.4:
     to-regex "^3.0.2"
 
 micromatch@^4.0.0:
-  version "4.0.2"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.2.tgz#4fcb0999bf9fbc2fcbdd212f6d629b9a56c39259"
-  integrity sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.1"
-    picomatch "^2.0.5"
+    braces "^3.0.3"
+    picomatch "^2.3.1"
 
 micromatch@^4.0.4:
-  version "4.0.4"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.4.tgz#896d519dfe9db25fce94ceb7a500919bf881ebf9"
-  integrity sha512-pRmzw/XUcwXGpD9aI9q/0XOwLNygjETJ8y0ao0wdqprrzDa4YnxLcz7fQRZr8voh8V10kGhABbNcHVk5wHgWwg==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.1"
-    picomatch "^2.2.3"
+    braces "^3.0.3"
+    picomatch "^2.3.1"
 
 micromatch@^4.0.5:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.2"
+    braces "^3.0.3"
     picomatch "^2.3.1"
 
 mime-db@1.45.0:
diff --git a/patches/security.diff b/patches/security.diff
new file mode 100644
index 00000000..66ecb059
--- /dev/null
+++ b/patches/security.diff
@@ -0,0 +1,287 @@
+Index: sagemaker-code-editor/vscode/extensions/npm/yarn.lock
+===================================================================
+--- sagemaker-code-editor.orig/vscode/extensions/npm/yarn.lock
++++ sagemaker-code-editor/vscode/extensions/npm/yarn.lock
+@@ -38,22 +38,22 @@ brace-expansion@^2.0.1:
+   dependencies:
+     balanced-match "^1.0.0"
+ 
+-braces@^3.0.1:
+-  version "3.0.2"
+-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
+-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
++braces@^3.0.3:
++  version "3.0.3"
++  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
++  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
+   dependencies:
+-    fill-range "^7.0.1"
++    fill-range "^7.1.1"
+ 
+ esprima@^4.0.0:
+   version "4.0.1"
+   resolved "https://registry.yarnpkg.com/esprima/-/esprima-4.0.1.tgz#13b04cdb3e6c5d19df91ab6987a8695619b0aa71"
+   integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
+ 
+-fill-range@^7.0.1:
+-  version "7.0.1"
+-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
+-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
++fill-range@^7.1.1:
++  version "7.1.1"
++  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
++  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
+   dependencies:
+     to-regex-range "^5.0.1"
+ 
+@@ -118,12 +118,12 @@ locate-path@^6.0.0:
+     p-locate "^5.0.0"
+ 
+ micromatch@^4.0.2:
+-  version "4.0.2"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.2.tgz#4fcb0999bf9fbc2fcbdd212f6d629b9a56c39259"
+-  integrity sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.1"
+-    picomatch "^2.0.5"
++    braces "^3.0.3"
++    picomatch "^2.3.1"
+ 
+ minimatch@^5.1.6:
+   version "5.1.6"
+@@ -151,10 +151,10 @@ path-exists@^4.0.0:
+   resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-4.0.0.tgz#513bdbe2d3b95d7762e8c1137efa195c6c61b5b3"
+   integrity sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==
+ 
+-picomatch@^2.0.5:
+-  version "2.2.2"
+-  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.2.2.tgz#21f333e9b6b8eaff02468f5146ea406d345f4dad"
+-  integrity sha512-q0M/9eZHzmr0AulXyPwNfZjtwZ/RBZlbN3K3CErVrk50T2ASYI7Bye0EvekFY3IP1Nt2DHu0re+V2ZHIpMkuWg==
++picomatch@^2.3.1:
++  version "2.3.1"
++  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.1.tgz#3ba3833733646d9d3e4995946c1365a67fb07a42"
++  integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==
+ 
+ pify@^4.0.1:
+   version "4.0.1"
+Index: sagemaker-code-editor/vscode/yarn.lock
+===================================================================
+--- sagemaker-code-editor.orig/vscode/yarn.lock
++++ sagemaker-code-editor/vscode/yarn.lock
+@@ -2618,11 +2618,11 @@ braces@^2.3.1, braces@^2.3.2:
+     to-regex "^3.0.1"
+ 
+ braces@^3.0.1, braces@^3.0.2, braces@~3.0.2:
+-  version "3.0.2"
+-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
+-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
++  version "3.0.3"
++  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
++  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
+   dependencies:
+-    fill-range "^7.0.1"
++    fill-range "^7.1.1"
+ 
+ browser-stdout@1.3.1:
+   version "1.3.1"
+@@ -4569,10 +4569,10 @@ fill-range@^4.0.0:
+     repeat-string "^1.6.1"
+     to-regex-range "^2.1.0"
+ 
+-fill-range@^7.0.1:
+-  version "7.0.1"
+-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
+-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
++fill-range@^7.1.1:
++  version "7.1.1"
++  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
++  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
+   dependencies:
+     to-regex-range "^5.0.1"
+ 
+@@ -6874,27 +6874,27 @@ micromatch@^3.0.4, micromatch@^3.1.10, m
+     to-regex "^3.0.2"
+ 
+ micromatch@^4.0.0:
+-  version "4.0.2"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.2.tgz#4fcb0999bf9fbc2fcbdd212f6d629b9a56c39259"
+-  integrity sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.1"
+-    picomatch "^2.0.5"
++    braces "^3.0.3"
++    picomatch "^2.3.1"
+ 
+ micromatch@^4.0.4:
+-  version "4.0.4"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.4.tgz#896d519dfe9db25fce94ceb7a500919bf881ebf9"
+-  integrity sha512-pRmzw/XUcwXGpD9aI9q/0XOwLNygjETJ8y0ao0wdqprrzDa4YnxLcz7fQRZr8voh8V10kGhABbNcHVk5wHgWwg==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.1"
+-    picomatch "^2.2.3"
++    braces "^3.0.3"
++    picomatch "^2.3.1"
+ 
+ micromatch@^4.0.5:
+-  version "4.0.5"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
+-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.2"
++    braces "^3.0.3"
+     picomatch "^2.3.1"
+ 
+ mime-db@1.45.0:
+Index: sagemaker-code-editor/vscode/build/yarn.lock
+===================================================================
+--- sagemaker-code-editor.orig/vscode/build/yarn.lock
++++ sagemaker-code-editor/vscode/build/yarn.lock
+@@ -879,11 +879,11 @@ brace-expansion@^1.1.7:
+     concat-map "0.0.1"
+ 
+ braces@~3.0.2:
+-  version "3.0.2"
+-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
+-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
++  version "3.0.3"
++  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
++  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
+   dependencies:
+-    fill-range "^7.0.1"
++    fill-range "^7.1.1"
+ 
+ buffer-alloc-unsafe@^1.1.0:
+   version "1.1.0"
+@@ -1422,10 +1422,10 @@ fd-slicer@~1.1.0:
+   dependencies:
+     pend "~1.2.0"
+ 
+-fill-range@^7.0.1:
+-  version "7.0.1"
+-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
+-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
++fill-range@^7.1.1:
++  version "7.1.1"
++  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
++  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
+   dependencies:
+     to-regex-range "^5.0.1"
+ 
+Index: sagemaker-code-editor/vscode/extensions/yarn.lock
+===================================================================
+--- sagemaker-code-editor.orig/vscode/extensions/yarn.lock
++++ sagemaker-code-editor/vscode/extensions/yarn.lock
+@@ -127,12 +127,12 @@
+     node-addon-api "^3.2.1"
+     node-gyp-build "^4.3.0"
+ 
+-braces@^3.0.2:
+-  version "3.0.2"
+-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
+-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
++braces@^3.0.3:
++  version "3.0.3"
++  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
++  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
+   dependencies:
+-    fill-range "^7.0.1"
++    fill-range "^7.1.1"
+ 
+ coffeescript@1.12.7:
+   version "1.12.7"
+@@ -180,10 +180,10 @@ fast-plist@0.1.2:
+   resolved "https://registry.yarnpkg.com/fast-plist/-/fast-plist-0.1.2.tgz#a45aff345196006d406ca6cdcd05f69051ef35b8"
+   integrity sha1-pFr/NFGWAG1AbKbNzQX2kFHvNbg=
+ 
+-fill-range@^7.0.1:
+-  version "7.0.1"
+-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
+-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
++fill-range@^7.1.1:
++  version "7.1.1"
++  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
++  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
+   dependencies:
+     to-regex-range "^5.0.1"
+ 
+@@ -205,11 +205,11 @@ is-number@^7.0.0:
+   integrity sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==
+ 
+ micromatch@^4.0.5:
+-  version "4.0.5"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
+-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.2"
++    braces "^3.0.3"
+     picomatch "^2.3.1"
+ 
+ node-addon-api@^3.2.1:
+Index: sagemaker-code-editor/vscode/remote/yarn.lock
+===================================================================
+--- sagemaker-code-editor.orig/vscode/remote/yarn.lock
++++ sagemaker-code-editor/vscode/remote/yarn.lock
+@@ -185,12 +185,12 @@ bl@^4.0.3:
+     inherits "^2.0.4"
+     readable-stream "^3.4.0"
+ 
+-braces@^3.0.2:
+-  version "3.0.2"
+-  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz#3454e1a462ee8d599e236df336cd9ea4f8afe107"
+-  integrity sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==
++braces@^3.0.3:
++  version "3.0.3"
++  resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
++  integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
+   dependencies:
+-    fill-range "^7.0.1"
++    fill-range "^7.1.1"
+ 
+ buffer-crc32@~0.2.3:
+   version "0.2.13"
+@@ -263,10 +263,10 @@ file-uri-to-path@1.0.0:
+   resolved "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz#553a7b8446ff6f684359c445f1e37a05dacc33dd"
+   integrity sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==
+ 
+-fill-range@^7.0.1:
+-  version "7.0.1"
+-  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz#1919a6a7c75fe38b2c7c77e5198535da9acdda40"
+-  integrity sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==
++fill-range@^7.1.1:
++  version "7.1.1"
++  resolved "https://registry.yarnpkg.com/fill-range/-/fill-range-7.1.1.tgz#44265d3cac07e3ea7dc247516380643754a05292"
++  integrity sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==
+   dependencies:
+     to-regex-range "^5.0.1"
+ 
+@@ -378,11 +378,11 @@ lru-cache@^6.0.0:
+     yallist "^4.0.0"
+ 
+ micromatch@^4.0.5:
+-  version "4.0.5"
+-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
+-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
++  version "4.0.8"
++  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
++  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
+   dependencies:
+-    braces "^3.0.2"
++    braces "^3.0.3"
+     picomatch "^2.3.1"
+ 
+ mimic-response@^3.1.0:
diff --git a/patches/series b/patches/series
index 9253290f..3638b3bd 100644
--- a/patches/series
+++ b/patches/series
@@ -8,4 +8,5 @@ local-storage.diff
 sagemaker-integration.diff
 license.diff
 sagemaker-idle-extension.patch
-terminal-crash-mitigation.patch
\ No newline at end of file
+terminal-crash-mitigation.patch
+security.diff

From fdbbed3fe89ff395f6788c01436b3d90f24cae09 Mon Sep 17 00:00:00 2001
From: Zuoyuan Huang <zuoyuan@amazon.com>
Date: Sat, 7 Dec 2024 07:44:48 +0000
Subject: [PATCH 6/6] Idle endpoint creates metadata file if not exist

**Description**

* Idle endpoint creates metadata file if not exist

**Motivation**

* Fix the issue of space that has never been opened will not auto
  shutdown

**Testing Done**

* Build CE package

**Backwards Compatibility Criteria (if any)**

* N/A
---
 .../src/vs/server/node/webClientServer.ts        | 10 +++++++++-
 patches/sagemaker-idle-extension.patch           | 16 +++++++++++++---
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/patched-vscode/src/vs/server/node/webClientServer.ts b/patched-vscode/src/vs/server/node/webClientServer.ts
index 15957445..aeced3ce 100644
--- a/patched-vscode/src/vs/server/node/webClientServer.ts
+++ b/patched-vscode/src/vs/server/node/webClientServer.ts
@@ -3,7 +3,7 @@
  *  Licensed under the MIT License. See License.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 
-import { createReadStream } from 'fs';
+import { createReadStream, existsSync, writeFileSync } from 'fs';
 import {readFile } from 'fs/promises';
 import { Promises } from 'vs/base/node/pfs';
 import * as path from 'path';
@@ -465,6 +465,14 @@ export class WebClientServer {
 		try {
 			const tmpDirectory = '/tmp/'
 			const idleFilePath = path.join(tmpDirectory, '.sagemaker-last-active-timestamp');
+
+			// If idle shutdown file does not exist, this indicates the app UI may never been opened
+			// Create the initial metadata file
+			if (!existsSync(idleFilePath)) {
+				const timestamp = new Date().toISOString();
+				writeFileSync(idleFilePath, timestamp);
+			}
+
 			const data = await readFile(idleFilePath, 'utf8');
 
 			res.statusCode = 200;
diff --git a/patches/sagemaker-idle-extension.patch b/patches/sagemaker-idle-extension.patch
index 32c2d6e4..4dd98f63 100644
--- a/patches/sagemaker-idle-extension.patch
+++ b/patches/sagemaker-idle-extension.patch
@@ -289,10 +289,12 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
 ===================================================================
 --- sagemaker-code-editor.orig/vscode/src/vs/server/node/webClientServer.ts
 +++ sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
-@@ -4,6 +4,7 @@
+@@ -3,7 +3,8 @@
+  *  Licensed under the MIT License. See License.txt in the project root for license information.
   *--------------------------------------------------------------------------------------------*/
  
- import { createReadStream } from 'fs';
+-import { createReadStream } from 'fs';
++import { createReadStream, existsSync, writeFileSync } from 'fs';
 +import {readFile } from 'fs/promises';
  import { Promises } from 'vs/base/node/pfs';
  import * as path from 'path';
@@ -323,7 +325,7 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
  			if (pathname === this._callbackRoute) {
  				// callback support
  				return this._handleCallback(res);
-@@ -451,6 +457,23 @@ export class WebClientServer {
+@@ -451,6 +457,31 @@ export class WebClientServer {
  		});
  		return void res.end(data);
  	}
@@ -335,6 +337,14 @@ Index: sagemaker-code-editor/vscode/src/vs/server/node/webClientServer.ts
 +		try {
 +			const tmpDirectory = '/tmp/'
 +			const idleFilePath = path.join(tmpDirectory, '.sagemaker-last-active-timestamp');
++
++			// If idle shutdown file does not exist, this indicates the app UI may never been opened
++			// Create the initial metadata file
++			if (!existsSync(idleFilePath)) {
++				const timestamp = new Date().toISOString();
++				writeFileSync(idleFilePath, timestamp);
++			}
++
 +			const data = await readFile(idleFilePath, 'utf8');
 +
 +			res.statusCode = 200;